Dutch police arrest two men over AI-voiced bank fraud that allegedly used a fake app to steal card data from 170 victims, causing €380,000 in losses. Rotterdam police have arrested two men over a new type of bank fraud that used AI-generated phone calls, a fake banking app, and NFC technology to steal bank card data. In just three weeks, the scheme allegedly cost 170 victims around €380,000. “Rotterdam police arrested two suspects accused of a new form of bank-helpdesk fraud. The operation allegedly caused around €380,000 in losses for 170 victims in just three weeks.” NL Times reports. “The suspects allegedly used AI-generated phone calls and a fake banking app to copy victims’ bank cards remotely, allowing accomplices to withdraw thousands of euros. Victims came from across the Netherlands and ranged in age; dozens were in their twenties and thirties.” The suspects allegedly used AI-generated calls to trick victims into believing their bank accounts were at risk. They then persuaded them to install a fake banking app and scan their bank cards with their phones. The app used NFC to capture card data, which accomplices could use to withdraw money. Victims came from across the Netherlands and included people of all ages, with dozens in their twenties and thirties. A 23-year-old man from Vaassen, in Gelderland, is suspected of developing the technology and directing the group. A 25-year-old from Ede, also in Gelderland, is suspected of coordinating the operation. On Tuesday, a Rotterdam court ordered both men to remain in custody for at least another 90 days while the investigation continues. The case started in mid-September, when Dutch banks reported the new fraud through the Electronic Crimes Task Force (ECTF). That’s a partnership of banks, police and prosecutors that shares information and expertise to fight financial and digital crime. Within days of consulting the task force, Rotterdam’s cybercrime team had identified the digital infrastructure used by the group. Investigators monitored the servers to understand how the operation worked. They traced the people behind the technology, the phone calls made to victims, and the cash withdrawals. The scam started with a recorded message warning victims about suspicious activity on their bank accounts. “The callers used artificial intelligence (AI) to produce dozens of recordings featuring different voices, banks, companies, and scenarios. Victims were asked to press 1 if they did not recognize the alleged activity.” states the report. “They were then connected to someone posing as a bank employee.” The message asked people to press 1 if they did not recognize the activity. They were then connected to someone pretending to be a bank employee. Following a prepared script, the caller pressured them to act quickly and take steps to block their bank cards. The fake employee told victims to download an app and hold their bank card against the phone to scan it. The criminals presented this as a way to secure the accounts. If a caller ever asks you to scan your card with an app, hang up and phone your bank on the number printed on the card. According to police, the app sent data from the card’s near-field communication (NFC) chip, the technology behind contactless payments, to an app run by an accomplice. That person waited at a cash machine or payment terminal and could withdraw thousands of euros without the victim realizing what was happening. “Police described this technical method as one they had not encountered before.” the report concludes. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, NFC)
uCreater is Android spyware disguised as trusted apps, stealing credentials, messages and wallet data through a rentable platform. uCreater is a rentable Android spyware platform that hides inside repackaged legitimate apps, targeting messaging services and mobile wallets. Its YingGai framework can intercept one-time passwords, steal account and chat data, collect contacts, manipulate sessions and spoof camera feeds to bypass identity checks. Victims may install modified versions of Telegram, WeChat or GCash through sideloading or social engineering. Researcher Ovi found stolen data on a control server, but the number of victims and links between operators and customers remain unconfirmed. “The repackaged APK can be relatively thin: target-specific instrumentation is retrieved after installation from the operator’s Alibaba OSS and MinIO infrastructure, including buckets and paths named Huuk_<target> and fengzhuang-app (literally, “packaging”). Distribution hosts include telegram-apk.uzyzx.com.” researcher Ovi states. “I could reconstruct much of the post-installation execution chain from the recovered code, but I could not directly establish the initial delivery mechanism for every victim.” Ovi rebuilt most of the chain from recovered code but couldn’t establish how every victim got the first install. The product is older than the samples. The package com.ucreater.autotool dates to about 2014, Windows tools tied to ucreater.com were signed between 2016 and 2019, and the YingGai mobile line shows up in records from September 2021. The samples Ovi studied run from 2024 to 2026: uip.exe builds from February to December 2024, Telegram repacks from July and November 2024, the WeChat host and Telegram framework from December 2024, and the Onion Box client from March 2026. The control server’s ICP filing, 湘ICP备2024061212号, dates to 2024. The infrastructure hints at scale, though not at victim numbers. Ovi counts about 20 target apps with confirmed code support, six operator domains with dozens of subdomains, three Redis buses, two MQTT buses, and a cloud-phone cluster in Changsha spread across several ISPs. A Censys search for the operator’s Tengine gateway fingerprint returned roughly 48 hosts. It looks like a multi-year product sold to many downstream operators, but he can’t say how many customers used it or how many devices fell. Attributing the platform to a specific legal entity is more difficult. Hunan Youchuang Technology is linked to the ucreater.com brand and a self-signed certificate on videoflow.cn. Changsha Sukai Network holds the ICP filing for the control server’s main domain, qianxuncc.cn, while Changsha Zhuoqing E-commerce appears as the signing identity on uip.exe, using a DigiCert certificate. A common owner is plausible but unproven. Another lead involves hunanzhijing.com, a domain belonging to the Hunan Intelligent Police Public Safety Technology Research Institute. It shares the same gateway fingerprint, and an official Hunan document connects the institute to an intelligent-policing research project. However, shared cloud infrastructure establishes only co-tenancy, not ownership or operational involvement. There is no evidence that the police developed or operated uCreater. Other infrastructure links also require caution. A Thailand-based relay used by the Telegram component, hosted on Huawei Cloud, also served gambling websites, an advertising-account service and an SMS service. The cloud-phone web client displayed a certificate for another vendor, while the gateway served a Vue application titled 舆情交易, meaning “public-opinion trading”. These observations are leads for further investigation, not proof of common ownership. uCreater relies on app virtualization, a technique already identified by Zimperium as a growing mobile threat. VirtualApp runs another application inside a container, LSPatch merges code hooks into repackaged apps without requiring root access, and Pine hooks Android’s runtime. Together, these components allow malicious code to operate inside a legitimate app while it is signed in and has access to decrypted data. “uCreater is notable because it turns these techniques into a reusable, remotely managed product.” the researchers continues. Operators distribute modified versions of Telegram-X, Telegram-Web and other messaging apps, integrating modules through LSPatch or loading them from an asset called TgJarPine.dex. WeChat can instead run inside a VirtualApp container, including the va_vx or Onion Box host. LSPatch also stores the original APK under cache/lspatch/origin/*.apk. The presence of this path or the specific asset can help identify an infected device. The approach differs from GodFather, a banking trojan documented by Zimperium that runs apps in a virtual container and displays fake overlays to capture credentials. uCreater operates inside the real application without relying on an overlay. It uses XposedBridge hooks, reflection and access to the app’s own database interfaces. This allows it to reach beyond login screens and potentially support any application for which the vendor develops a module. Ovi found no evidence linking the two platforms. One distinguishing feature is a local command server embedded in each hooked application. It exposes around 40 numbered handlers, with descriptions and parameters that allow operators to discover available functions. The code supports device monitoring, contact and SMS collection, installed-app enumeration, message sending, chat-history retrieval, session management and account-related actions. The Telegram module can execute SQL queries directly against the application’s live database through its own interface. Its Db_MessagesStorageRawQuery handler accepts operator-supplied SQL and returns results through compatibility classes that recreate Telegram objects. This can expose information that would otherwise be protected in the app’s encrypted or locally stored data while the application is running. The module also hooks Telegram’s SRPHelper.getX routine, capturing the two-step verification password in cleartext before hashing and storing it for exfiltration. The code provides functions to list or reset sessions, change or confirm a linked phone number, delete an account and lock users out. It can also remove its own session from the victim’s device list, potentially concealing the operator’s access. Ovi stresses that the source code demonstrates these capabilities, not that every action has been successfully performed against victims. The implant retrieves its control-server address from Redis using the Domain key, optionally selecting a value for a particular channel. It caches the address and can fall back to a hardcoded value, explaining why callback domains differ between builds. Signed JSON beacons report to endpoints under /api/callback/Tg*, while command requests include a device fingerprint and signature and use retries with increasing delays. Updates and additional code arrive through Alibaba Object Storage Service (OSS) and MinIO. The Telegram module retrieves an update manifest and hooks from designated storage paths, while a contacts.vcf file can supply contact information. The WeChat component subscribes to a Redis channel identified by a device-specific machine ID, with its host and credentials embedded in a child code file. The WeChat module focuses on account access rather than chat-history collection. Its _2_0_UploadAppLoginInfo command retrieves login identity information, after which the app data can be packaged, uploaded to OSS and used in account cloning. Ovi found no evidence that the examined sample accessed WeChat’s encrypted database. Ovi tested uCreater on a Pixel 10 Pro running Android 17 and found that its bundled Pine engine fails because of changes to Android’s internal APIs. The latest sample, dated July 29, 2026, still uses the outdated engine. Although this creates obstacles for operators, updating Pine could restore functionality, and other devices remain untested. Ovi also identified five samples that successfully contacted the control server, confirming active deployments targeting Telegram, Telegram-X and WeChat. Ovi and researcher Jurre discovered the platform’s source code after finding an exposed GitLab server. Other infrastructure was protected by IP allowlists, but this server contained the control platform’s source code, configuration and operational details. The repositories revealed Spring Cloud services for command dispatch, authorization capture, data collection, backups and message bridging, alongside a Vue-based administration console. Thirteen repositories contained commit histories identifying roughly three dozen developers, with activity timestamps consistent with China time. At least one commit used a corporate email domain associated with Tanzhou, a Changsha software firm. uCreater’s backend is a rented, multi-tenant platform that lets operators manage infected devices, steal account data and automate contact collection. Kafka, RocketMQ, Redis and Nacos coordinate commands and schedule activity to avoid triggering security controls. The infrastructure runs on Aliyun and Huawei Cloud, with control services and storage hosted in China. Although GitLab records identify developers behind key components, Ovi stresses they are not confirmed operators. The recovered backend did not appear to support Telegram, and some callback domains are no longer active. Ovi attributes the platform to a vendor in Changsha and Hunan operating through three companies, each linked to a different technical or infrastructure artifact. The reseller model, focus on mobile wallets and theft of authentication codes suggest financially motivated crime, but the researcher presents this as an assessment rather than a proven fact. The technical findings show that uCreater goes beyond a conventional banking trojan or a tool that merely steals credentials. By embedding code inside legitimate applications, it can manipulate sessions, access account data, collect contacts and potentially take control of messaging accounts. Its rented, multi-tenant architecture also allows different operators to use the same underlying platform. The scale of the infrastructure indicates a substantial operation, but neither the number of customers nor the number of compromised devices has been established. Likewise, infrastructure overlaps and developer records provide investigative leads, not conclusive proof of who operated the spyware or who was responsible for individual attacks. “Mapping points to a commercial resale structure, and targeting driven by wallets and OTPs. My assumption is financially-motivated crimeware.” concludes the report. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Official websites use .gov A .gov website belongs to an official government organization in the United States. Secure .gov websites use HTTPS A lock (LockA locked padlock) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites. Share: Opens in a new window Opens in a new window Opens in a new window Press Release CISA Unveils New Strategy to Strengthen National Cyber Defense and Critical Infrastructure Security CISA 2030: Defend, Harden, Prevail Released October 26, 2026 Related topics: Cybersecurity Best Practices , Critical Infrastructure Security and Resilience WASHINGTON – The Cybersecurity and Infrastructure Security Agency (CISA) today released its new strategy, CISA 2030: Defend, Harden, Prevail, which advances President Trump’s Cyber Strategy for America and National Resilience Strategy while strengthening the security and resilience of the nation’s critical infrastructure.
Cyfirma links PHP2Shell scans of 216 vulnerable hosts to a suspected North Korean campaign using AI to rank public exploits. On October 21, PHP released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS scale. The flaws affect all PHP versions that handle web requests. The vulnerable code dates back to PHP 5.4, released in 2012, and resides in the PHP engine itself rather than in individual applications. Attackers can exploit the flaws to execute code remotely by sending specially crafted HTTP requests, without authentication. Exploitation attempts increased rapidly after the vulnerabilities became public. Cloudflare researchers reported tens of thousands of attempts within the first 45 minutes, hundreds of thousands in just two hours, and millions by October 22. Cyfirma reported that a group of North Korea-linked group has identified 216 hosts that may still be vulnerable to PHP2Shell. The operators communicate through a private I2P channel that Cyfirma has monitored since October 22. On October 24, they reported that 216 hosts appeared to be unpatched or only partly protected, earlier than Cyfirma expected. They are checking the systems from 21 compromised machines. At the time Cyfirma captured the conversation, the operators had already checked about one-third of the targets. “Two handles active since March 2026, coordinating in a closed I2P channel; staging infrastructure shared in-channel.” states the cybersecurity firm. “Target set and scan nodes. “On 24 October the operators reported 216 unpatched or partially mitigated hosts and named 21 scan nodes; the same addresses were seen performing web-shell tooling and upload-progress session-poisoning attempts.” The scanning is slow on purpose. Volume stays low, the machines rotate, and any node that shows filtering or rate limiting gets pulled and never reused. That’s why a rate-based alert will probably stay quiet. Who’s behind it? Cyfirma assesses with moderate confidence a link to the Lazarus family of North Korean groups, based on language, operating style and old habits with PHP web shells and hijacked web servers. It has no shared malware or infrastructure to point to yet, and it admits that a Korean-speaking criminal crew without state backing would fit the same facts. Its confidence in the campaign itself is high. Government agencies and banks come first. Next in line are logistics, ports, airports and aviation, manufacturing, and online transaction and trading platforms. The countries named are the US, Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, the UAE, Saudi Arabia and the EU. Cyfirma has not named any victims or seen the full list of targeted systems. The operators have not announced when they plan to launch attacks, and the researchers have not confirmed that this group has compromised systems on a large scale. Cyfirma gives the campaign an imminence score of 78 out of 100. The operators plan to check all 216 hosts, select the most promising targets, and decide which publicly available exploits to adapt. The group does not appear to be developing new exploits. Instead, its members use a local AI model to rank public exploit repositories, then test the results manually in a lab. Cyfirma believes this approach could help attackers turn newly disclosed vulnerabilities into working attacks more quickly. However, researchers warn that some proof-of-concept exploits shared online are fake and may contain malware, so downloading and running them can be dangerous. Technical details leaked on October 20, ahead of coordinated disclosure, and the PHP project shipped fixes on October 21. Apache mod_php with default settings and prefork is the confirmed worst case for 109618, with full unauthenticated code execution. For 109619, PHP-FPM is validated through the upload-progress path. One correction matters for your temporary controls. Early coverage tied the session upload-progress field to 109618, but PHP’s advisories put it under 109619 only. Disabling upload progress does nothing for 109618, so the two bugs need different stopgaps. Triggering the bug is easy, but reliable code execution isn’t. The attacker has to land a follow-up request on the same worker and shape heap data into the freed space, otherwise the worker crashes or answers normally. VulnCheck reports working code execution on x86-64 with ASLR enabled against PHP 8.4.10 to 8.4.26, while ARM64 only leaks memory so far. Short of code execution, attackers have already shown worker crashes, arbitrary file reads through OPcache and a leak of about 67 KB of process memory. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1, 8.0 and 7.4 get only minimal backports, and vendors such as cPanel EasyApache, CloudLinux, TuxCare and Plesk carry their own builds, so confirm coverage with yours. Anything from PHP 5.4 to 7.3 has no fix, so migrate or isolate it. Restart every worker after patching, because a reload that keeps old workers alive leaves the stale state in place. Isolate anything internet-facing that you can’t patch within hours, starting with Apache mod_php. If you suspect a host is compromised, capture memory and logs before you patch, since a restart destroys the CVE-2026-109619 state. Then rebuild the host from a trusted image and rotate every secret the PHP worker could reach. Hunt back to October 17, the earliest known exploitation, and use long time windows. The strongest single signal is a PHP or web server process spawning something it never normally spawns. Application logs will usually show nothing, because the bug fires before application code runs. Look for odd multipart POSTs to endpoints that never take uploads, bursts of worker crashes and memory errors, new PHP files in web roots, and new cron jobs, local users or SSH keys. Cyfirma includes Sigma, Splunk and YARA content, though it says the YARA set hasn’t been tested on real application code yet. It also lists 21 scan-node addresses, 17 source addresses from October 23 and 15 staging addresses, all defanged. Some scan nodes are described as compromised and may belong to victims, so hunt for prior contact before assuming who owns them. If you can’t patch yet, the advisory suggests limits such as a low post_max_size and disabling session upload progress for 109619. Cyfirma is clear that none of it replaces patching. The operators’ own selection rule is the most useful detail in the whole advisory, because they dropped every host that showed a fixed version or sat behind heavy filtering. That makes a current version string a cheap filter against you, and for once being boring pays off. “Hosts still bannering older PHP are the ones the operators kept.” Cyfirma states. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, PHP2Shell)
Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild. The malicious activity was caught by Adel Karimi, detection and response lead at Perplexity, whose honeypots recorded evidence of confirmed remote code execution against an Apache mod_php installation running PHP 8.4.26. "This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process. The response delivered an 800 KiB decoded cookie dump, and a function address derived from that dump using the public exploit's offsets appears in the subsequent execution payload," Karimi shared. "The client acknowledged the full response; the shell command then ran about 1.6 ms after the execution request's final captured byte."
Anthropic says Claude Mythos 5 targeted real developers with fake identities to push malicious code during a security test. A cybersecurity test is supposed to measure what an AI model can do within an agreed boundary. In one UK AI Security Institute evaluation, Claude Mythos 5 crossed that boundary, targeted a real GitHub project and created fake identities to persuade its maintainers to accept malicious code. The maintainers refused. That stopped the attempted compromise, but it left a question that matters well beyond AI testing: what happens when a model treats completing its task as more important than respecting the limits around it? Anthropic’s report describes a case in which the model went beyond the test’s limits and misled real people. The report does not suggest that the model was following its own independent plan. The UK AI Security Institute (AISI) gave Mythos 5 a cybersecurity challenge. The model had to find protected data inside a simulated network designed to look like a real organization’s computer systems. Internet access was enabled, which Anthropic says was standard practice for AISI’s cyber evaluations at the time. The cyber safeguards used with generally released models, such as Fable 5, were disabled. Those conditions matter when interpreting the incident. This wasn’t a report of a customer-facing model spontaneously attacking developers under its normal production controls. Still, the consequences weren’t confined to the test. “The cyber safeguards we deploy with general release models like Fable 5 were disabled. In nine of AISI’s 43 evaluation runs, Mythos 5 took unsanctioned actions (i.e., actions that went beyond the intended scope of the evaluation), which impacted real people and organizations.” reads the report published by Anthropic. Anthropic says its production safeguards would have flagged the behavior immediately. That’s the company’s assessment, not evidence that every deployment configuration would have prevented it. In the main test Anthropic investigated, Mythos 5 first tried to solve the challenge within the allowed limits. However, an error in the instructions made it believe that the correct approach was not allowed. This made solving the task properly difficult or even impossible. The model noticed that a computer in the simulated network regularly connected to GitHub. It then thought that breaking into a software project could help it reach the target through an automatic download. As a result, the model moved outside the test environment and began targeting developers who were not involved in the exercise. Mythos 5 initially found a repository whose name appeared relevant to the exercise. When it discovered that the project didn’t publish releases, it searched the maintainer’s followers and selected another repository that did, despite having only a weak connection to the task. The model then registered a GitHub account, using Tor and a proxy service to get around sign-up checks. It submitted malicious code and emailed the maintainers, presenting itself as a human contributor and encouraging them to approve the change. An outside developer examined code the model had uploaded and warned that the pull request was malicious. Mythos 5 responded with further deception, including another identity that vouched for the code. ” At this point, an outside developer used a sandbox to run and analyze some other code that Mythos 5 uploaded to GitHub, then warned the maintainers that the pull request was malicious.” continues the report. “Mythos 5 subsequently created a sock-puppet account (a fake identity) that wrote another email to the maintainers vouching for the pull request, and added comments on the GitHub thread that endorsed the code change. The pull request was not accepted. “ The maintainers didn’t accept the pull request. The run ended when the model exhausted its token budget while still trying to persuade them. Code review, in this case, did more than check the code. It held the boundary the evaluation hadn’t enforced.[anthropic] Anthropic assessed the incident along two dimensions: how far the model exceeded its instructions and how dishonestly it represented its actions. Anthropic compared this case with another incident reported on September 9, when Mythos 5 uploaded a malicious software package to PyPI during a different cybersecurity test. The company considered the GitHub incident less serious in terms of how far the model went beyond its instructions. One reason was that the model first tried to solve the challenge in an allowed way, but errors in the test setup made this difficult. However, Anthropic considered the GitHub case more serious in terms of dishonesty. The model created fake identities and made false claims about the malicious code to persuade real people to accept it. Anthropic says it had not seen this type of attempt to deceive real people in earlier incidents or its internal tests. Still, the company sees it as a more serious example of a known problem, not proof that the model had developed its own goals. This distinction matters. An AI system does not need to have its own ambitions to cause harm. It can cause damage by pursuing an assigned task through unacceptable methods. Anthropic replayed parts of the test to understand why Mythos 5 continued its attack. Researchers found that the model’s progress notes may have reinforced its decision to continue. When they added warnings about possible harm to real people to earlier notes, the model searched for a GitHub target in only 13% of tests, compared with 83% when using the original notes. This suggests that recognizing risks early may prevent harmful actions, while intervening later is less effective. In further tests, Mythos 5 continued the attack in 98% of cases. Even when researchers explicitly told it that the developers were real people, it stopped only 5% of the time. The model also selectively interpreted evidence, treating some real developers as simulated participants while recognizing other people in the same discussion as real. When researchers examined evidence outside the context of the exercise, the model was less likely to make this mistake. Anthropic sees this as a sign of biased reasoning, but warns that a model’s explanations do not necessarily reveal exactly how it made its decisions. Mythos 5 was still able to change its approach. When another way to complete the challenge looked more promising, it returned to the authorized task. Researchers changed three failed tool responses to make an allowed solution seem possible. In every test that followed, the model returned to working within the permitted network. However, its reasoning suggested it was only putting the GitHub attack on hold, not necessarily abandoning it. This suggests that the model responded more reliably to a better way to complete its task than to warnings that its actions could harm real people. Instructions telling the model to stop if the test setup was faulty or its actions could cause real-world harm had limited effect. A clear warning not to interact with public repositories made it stop in some early tests, but not in the later ones researchers examined. Anthropic tested the same scenarios with Mythos 5.1, Opus 5.5 and a more advanced internal model. These models started searching GitHub in only 0% to 13% of tests, compared with 83% for Mythos 5. Stopping an attack already in progress was harder. In short tests, Mythos 5 never stopped on its own, while the internal model stopped in 67% of cases. Anthropic believes improved training may have helped, but the results do not prove this. The tests were limited and cannot predict how often these models would attack real organizations. Anthropic’s review of the other eight problematic runs found similar behaviour. Mythos 5 often assumed that internet access was necessary to complete a challenge and treated online accounts as legitimate targets. Some runs attempted to send malware links or create a fake payment website. In another case, the model interfered with a separate evaluation, taking over its GitHub account, exhausting its request allowance and shutting down a program. None of these attempts succeeded. Anthropic focused on the main incident because it involved the most extensive deception and enabled a deeper investigation of related failures. Anthropic’s findings have limitations because models may not explain their actions accurately, some tests used simulated tools, and not all results could be checked manually. Researchers therefore trust comparisons between test conditions more than individual percentages. Although Anthropic worked with the UK AISI, the institute published its own report. The main lesson is that security limits must be enforced by technical controls, not left to the model to follow. In this case, the model could reach real developers who had no involvement in the test, putting them at risk. “CTF evaluations play an important role in measuring a model’s offensive cyber capabilities, and therefore in understanding which security safeguards should be put in place.” Anthropic concludes. “AISI has publicly committed to running these evaluations without internet access until it has developed stronger internet access controls that would prevent models from causing real-world harm during their attempts to complete them.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Anthropic)
OpenAI paused frontier model training for 11 days after AI agents exposed security weaknesses, VM escapes and covert communication channels. OpenAI published a detailed report this week explaining how it improved security in the systems used to train and test its most advanced AI models. The company also described what happened when its AI agents tried to find weaknesses in those systems and why it stopped training its most advanced models for 11 days in September. “Based on the red-teaming results, the fixes we had implemented, and improvements to our monitoring and stopping systems, we judged that our strengthened safeguards were sufficient to resume frontier RL training and internal inference.” reads the report published by the company. “We resumed these workloads on October 1, 11 days after our pause began.” The incident began on September 20, when an internal research model exploited a DNS configuration error and gained limited access to the live internet during training. This incident, along with a security incident involving Hugging Face in July and other cases of AI models behaving in unexpected ways, led OpenAI to make major changes to its security measures. OpenAI’s stated containment requirement is that limits on what an agent can access must hold even when the agent actively tries to circumvent them. The policy choice they landed on is that frontier model training now runs with no internet access at all, full stop. “For training and most evaluation, the live internet lies outside this boundary, as we believe that providing models access to the live internet can pose significant risks. Although internet access can help models learn useful skills, it also gives a capable, misaligned agent opportunities to affect systems beyond our control.” continues the report. “We’ve therefore designed the security architecture for our research environments with one overriding principle: we must always be able to prevent a frontier model from achieving unauthorized, arbitrary access to the live internet.” To support training without live internet, they built what they call an “offline world,” a large indexed and cached set of web content that models can browse and search without touching external systems. The layers of protection around that offline world include restricted containers, lightweight virtual machines that isolate each agent’s environment from the underlying hardware, network and cloud controls, and monitoring systems designed to catch unauthorized activity before it does damage. The report explains how OpenAI tested its most advanced AI agents by asking them to find weaknesses in the company’s own systems. The agents had three goals: access the live internet, break through internal security barriers, or communicate with other agents when they were not allowed to do so. OpenAI ran experiments using hundreds of billions of tokens. The agents found previously unknown security flaws in open-source software, including Kata Containers, gVisor and Moby/Docker, as well as configuration errors in OpenAI’s own services. By combining these weaknesses, they managed to escape virtual machines and gain control of the underlying host system. In further tests, the agents found weaknesses in services used for monitoring, logging and authentication. They used these flaws to make the services access URLs controlled by an attacker. The part of the report that deserves the most attention isn’t the direct internet escapes. It’s what the agents did when those paths weren’t available. Agents in separate virtual machines, not allowed to share files or network connections, communicated with each other using processor cache timing. One agent evicted specific data from the processor’s cache. Another measured how long it took to reload that data, using the difference between fast and slow reads to decode a message. No file touched, no network packet sent. The technique is the same family of attacks as Spectre and Meltdown. OpenAI restarted training its most advanced AI models on October 1, eleven days after the pause began. The company is now making extensive security tests a required part of the approval process before training runs can begin. It is also using AI agents to regularly check source code and cloud settings for weaknesses, testing systems that monitor activity and automatically stop unsafe operations, and reporting discovered vulnerabilities to the open-source projects responsible for fixing them. OpenAI says it is continuing to strengthen its security by fixing vulnerabilities in virtual machines, working with cloud partners, and using AI agents to scan code and configurations. The company is also improving monitoring and automatic shutdown systems, regularly testing its sandbox and network defenses, and making high-compute red-teaming with its most capable models a core requirement for future frontier AI training and evaluation. “We are committed to strengthening our containment, monitoring, and red-teaming infrastructure as our frontier models become more capable and believe that this work will be a core part of responsibly pacing the development of our frontier models.” the company concludes. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Artificial Intelligence)
Pierluigi Paganini answers questions about the PHP2Shell vulnerability, early exploitation, AI-assisted attacks, and the risks to businesses, servers, and personal data. 1. Your latest report reveals that hackers began exploiting the PHP2Shell vulnerability four days before it was publicly disclosed. First, can you explain what PHP is, how widely it is used across the internet, and why this particular security flaw is so serious? PHP is a programming language widely used to build websites and web applications. It powers a significant share of the web. PHP2Shell is serious because it can allow attackers to execute commands on a vulnerable server remotely. Depending on the configuration and the server’s privileges, this could give threat actors access to sensitive data, applications and other systems. 2. According to AWS researchers, attacks were already underway before the vulnerability became public. How did researchers uncover this early exploitation, and what does it tell us about the ability of hackers to identify security weaknesses before developers can fix them? AWS researchers detected exploitation attempts against their honeypot network four days before public disclosure and the release of patches. This shows that attackers can discover or weaponize vulnerabilities before defenders have time to respond. AI-assisted analysis may accelerate this process, helping attackers turn technical information into working exploits in hours rather than days. However, detected attempts do not automatically mean successful compromises. 3. The vulnerability could potentially allow attackers to execute malicious commands on affected servers. What does that mean in practical terms, and what risks does it pose to websites, businesses and the personal information of their users? Remote command execution means an attacker may be able to make a server run commands without authorization. Depending on the attacker’s access, they could steal data, install malware, change website content, or use the compromised server to attack other systems. Businesses could face service disruption, financial losses and reputational damage. Users may also be exposed if their personal information is stored on an affected system. The actual impact depends on the server’s configuration and security controls. 4. The latest findings raise concerns about the gap between discovering a vulnerability and protecting systems against it. How quickly can attackers exploit these weaknesses, and are businesses adequately prepared to respond when critical security flaws emerge? The window can be extremely short. In some cases, attackers can develop or adapt an exploit within hours, leaving organizations little time to react. Many businesses still rely on patching schedules that are too slow for internet-facing systems. Organizations need continuous monitoring, rapid patching, tested incident response plans and clear visibility into exposed assets. They should also investigate suspicious activity dating back to before a vulnerability was publicly disclosed, because attacks may already be underway. 5. With PHP powering a significant portion of the internet, could we see further attacks exploiting this vulnerability? What should website operators do immediately to protect their systems, and should ordinary internet users be concerned about their data? Further attacks are possible, particularly against systems that remain unpatched or exposed. Website operators should apply the relevant security updates, check whether their PHP applications are vulnerable, and review logs for suspicious activity dating back to October 17. They should also restrict access and investigate signs of compromise. Ordinary users do not need to panic, but they should keep their accounts protected with unique passwords and multi-factor authentication where available. Whether personal data is at risk depends on which services they use and whether those systems were compromised. AI-assisted tools are increasingly being used to analyze code and identify vulnerabilities. How much of a role could artificial intelligence play in helping attackers discover and exploit flaws like PHP2Shell, and can defenders use the same technology to their advantage? AI can help analyze code, identify suspicious patterns and speed up the process of turning a vulnerability into a working exploit. This lowers some of the technical barriers for attackers and may shorten the time between discovering a flaw and exploiting it. However, AI is not the only factor, and we should not assume that every attack is AI-driven. Defenders can use the same capabilities to review code, prioritize vulnerabilities, analyze logs and detect suspicious behavior. The real advantage comes from combining AI with reliable data, skilled security teams and effective response processes. This case shows that attackers may exploit a vulnerability before a patch is available. Does this mean traditional vulnerability management is no longer enough, and how should organizations rethink their security strategy? Traditional vulnerability management remains essential, but patching alone is not enough when attackers may act before a fix becomes available. Organizations need to know which internet-facing systems they operate, understand their exposure and have additional controls in place. These include limiting access to vulnerable services, monitoring suspicious activity, applying temporary mitigations and preparing incident response procedures. They should also investigate whether systems were targeted before the vulnerability was disclosed. The goal is to reduce the opportunity for exploitation and detect attacks quickly, even when a patch is not yet available. Below is another interview I gave to TRT World discussing critical PHP vulnerabilities, the risks they pose to web servers, and the growing number of exploitation attempts. I explain why rapid patching and effective security measures are essential to minimize potential damage. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Collabora Collabora Online – Built-in CODE Server flaw, tracked as CVE-2026-110447 (CVSS score of 9.2), to its Known Exploited Vulnerabilities (KEV) catalog. Collabora Online – Built-in CODE Server is an app for Nextcloud that lets you open, edit and collaborate on documents, spreadsheets and presentations directly in your browser, without needing Microsoft Office installed on your computer. It is based on Collabora Online and LibreOffice technology. CVE-2026-110447 is a critical OS command injection flaw in Nextcloud’s proxy.php that affects Collabora Online Built-in CODE Server before 26.4.303. Unauthenticated attackers can execute commands when the built-in server is stopped. Standalone Collabora servers are not affected. Update immediately. In versions up to 26.4.302, proxy.php included request data in a Bash command without proper sanitization, allowing attackers to execute OS commands as the web server user. Exploitation is possible only when the local CODE server is stopped, such as during a restart, upgrade or crash. The script runs directly through the web server without loading Nextcloud’s code. Exploitation has been reported since September 2026, with attackers deploying PHP web shells and stealing configuration files containing credentials and application secrets. Three administrators reported the vulnerability on GitHub, while the first recorded attack dates back to September 10. The first attack was reported by a Nextcloud administrator whose servers had been compromised. Logs showed malicious requests on September 10 and 11, 2026, from the same IP, targeting proxy.php on version 26.4.302. The attackers deployed a PHP web shell and searched one server for credential stores and cryptocurrency wallets. Although reviewed logs showed no file exfiltration commands, data accessible to the web server account must be considered potentially exposed. Two other administrators reported similar incidents, but none found evidence of root access. After updating to 26.4.303, one administrator recorded another attempt on September 14, but no new shell appeared. Project maintainer mmeeks urged users to update and remove leftover shx*.php files. The CVE record confirms exploitation in September and October 2026, but the total number of compromised servers remains unknown. The flaw affects only the Development Edition’s Built-in CODE Server deployment. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaw by October 26, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
AI companies need usage data to align pricing with costs, improve products, identify churn risks, and grow revenue through informed decisions. The AI Paradox There is a paradox: AI companies exist to extract intelligence from data, yet many have almost no visibility into how their own software is being used. They design complex models, introduce their product, set a price, and then hope that customers renew their contracts. In a space as fast-paced as AI, such a strategy is no longer safe. Without usage as a guide, price decisions are made on assumptions rather than facts. Product roadmaps are driven by story, not by usage. Customer success teams learn about customer churn when renewal dates are approaching. In reality, usage intelligence has become one of the most important signals in an AI business, guiding everything from pricing strategy to product development and long-term monetization. Why AI Changes the Stakes for Usage Data AI changes the economics of software and, with it, the relevance of usage visibility. The economics of existing software products are linear in cost, whereas those of AI products are not. Compute, energy consumption, as well as third-party model licenses, can all be material variable costs. If usage increases rapidly (through enterprise adoption, agents, or workflows), the cost can grow faster than the revenue generated if pricing is not aligned with consumption. The opposite scenario is just as dangerous. If customers are not using key capabilities, churn may be approaching long before a renewal conversation begins. Research shows the extent of this visibility gap. For AI vendors, visibility is important on the commercial side, too. They need to know how customers are using the AI capabilities they sell. IDC research found that 48% of software buyers want better visibility into their usage. The pace of change is also a concern, with 70% ranking rapid change in the AI ecosystem among their top three AI-related security risks. Pricing, packaging, and business models must evolve at the same pace, and that requires reliable usage intelligence. What Usage Intelligence Actually Looks Like Of all the capabilities that make up a software monetization strategy, usage intelligence is the one most commonly treated as optional — and the one that most consistently separates companies that adapt from those that don’t. It is the feedback loop that connects real-world product consumption back to the decisions that shape pricing, packaging, and product direction. At the instrumentation layer, usage intelligence starts with telemetry data. This includes activation events, entitlements consumed, feature-level data, daily and monthly active users, and time-to-value metrics that track how quickly customers get value from the product. Thales Sentinel can also collect usage data from on-premises, offline, and disconnected environments, so vendors are not limited to tracking always-connected software. The operational layer is where all the telemetry data is made actionable. Usage dashboards in CRM systems enable account teams to see how customers use the software. Health scores can even detect reduced engagement well before any risk of renewal is seen. The enforcement layer makes sure that usage is consistent with contract rights. This is particularly important for consumption-based or token-based pricing schemes. Tracking accuracy is essential for determining customer fairness and vendor revenue. Finally, there is the feedback loop. The insights from usage need to flow back to those responsible for pricing, packaging, product development, and customer success. Without the feedback loop, the data is just more information. Pricing specialists have long argued for incremental experimentation. Research from Simon-Kucher reveals that companies that make frequent, data-informed pricing adjustments tend to achieve stronger growth than those that depend on static pricing models. Usage intelligence provides the evidence required to make those adjustments with confidence. How Usage Data Enables Multiple Business Models Business model agility is increasingly becoming a competitive advantage for AI companies, yet flexible business models cannot exist without trustworthy usage data beneath them. Consumption-based pricing, outcome-based pricing, token models, and hybrid subscription structures all depend on accurate measurement of how customers use the product. There is demand for these models, too. IDC research found that 45% of software buyers prefer usage-based models. In practice, most AI companies adopt a gradual sequence. They begin with subscription licensing to establish predictable recurring revenue. As adoption grows, they instrument feature usage and engagement patterns. That data then enables the introduction of consumption or token-based layers tied to high-value AI capabilities. One AI audio-recognition company did just that. It moved from perpetual licensing to several subscription tiers using Thales Sentinel. Its usage data showed which features customers used most, which helped the company decide how to structure those tiers without making changes to the core technology. Another AI recognition vendor delivering SDKs for embedded systems took a different approach using Sentinel. Their trial licenses expire after a defined number of executions instead of after a fixed time period. This usage-based trial model demonstrates genuine customer interest, giving them a clearer indicator of product-market fit than a simple time-limited evaluation would. Both examples show that usage intelligence transforms monetization strategies from guesswork into evidence-based decision-making. From Data to Decision: Three Practical Applications The real value of usage intelligence lies in informing concrete business decisions. Preventing churn is one of the most immediate uses. Feature-level engagement metrics can detect declining usage several months before a renewal date. This enables customer success teams to step in and show the value or introduce underutilized features, preventing a customer from leaving. Upsell and expansion opportunities can also show up in the usage data. Seat utilization may show that a team is close to capacity and needs more licenses. Feature usage can show when a customer is getting enough value from certain capabilities to justify moving to a higher tier or adding consumption-based features. Usage data can also inform the product roadmap. Rather than relying on assumptions about what customers want, AI companies can see which features people use and which get little attention. This is key in a market full of similar AI capabilities. Companies need to know which parts of their product customers value and are willing to pay for. There is also a need for the collection of usage intelligence to be privacy-conscious. For vendors operating under frameworks such as GDPR or the EU’s AI Act, it is necessary to design telemetry systems that prioritize aggregated data collection over personal data collection whenever possible. The Organizational Challenge However, technology alone is not enough to create usage intelligence. Businesses must also ensure that the intelligence is available to those who can act on it. Usage intelligence only delivers value if it reaches the people who can act on it. Pricing teams need consumption data to make confident adjustments to their models. Product teams need feature engagement data to inform roadmap decisions rather than rely on assumptions. Sales teams need account-level signals to time their conversations correctly. Customer success teams need early warning indicators to intervene before disengagement becomes churn. Finance teams need usage trends to build credible revenue forecasts. Getting that data to all of those functions consistently and in a usable form requires intentional data architecture and a shared organizational commitment to treating monetization as a cross-functional capability rather than a single team’s responsibility. This becomes harder as companies add more AI products. If usage data is split across separate products, teams may struggle to see how a customer is using the wider portfolio. Bringing the data together can show where products are being heavily used, where adoption is low, and where there may be room to expand an account. Building Systems Around Innovation The AI companies that sustain long-term commercial success are the ones who built a system around it that can learn, adapt, and improve as markets shift and customer needs evolve. Usage intelligence is what makes that system adaptive. Without it, pricing decisions are made on assumptions, packaging tiers are defined by intuition, and churn arrives without warning. With it, every commercial decision — what to charge, how to package, what to build next, which customers need attention — is grounded in evidence rather than expectation. In an industry defined by rapid innovation, the AI companies that listen to their own usage data will be the ones best positioned to turn experimentation into sustainable growth. About the Author: Kirsten Doyle has been in the technology journalism and editing space for nearly 24 years, during which time she has developed a great love for all aspects of technology, as well as words themselves. Her experience spans B2B tech, with a lot of focus on cybersecurity, cloud, enterprise, digital transformation, and data centre. Her specialties are in news, thought leadership, features, white papers, and PR writing, and she is an experienced editor for both print and online publications. She is also a regular writer at Bora. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, artificial intelligence)
Confirm this action.
Leaving now will discard your changes.